KRACK

Short description: Attack on the Wi-Fi Protected Access protocol

KRACK

KRACK attack logo

CVE identifier(s)| CVE-2017-13077,

CVE-2017-13078,
CVE-2017-13079,
CVE-2017-13080,
CVE-2017-13081,
CVE-2017-13082,
CVE-2017-13084,
CVE-2017-13086,
CVE-2017-13087,

CVE-2017-13088
Date discovered| 2016; 10 years ago (2016)
Discoverer| Mathy Vanhoef and Frank Piessens
Affected hardware| All devices that use Wi-Fi Protected Access (WPA)
Affected software| All operating systems that use WPA

KRACK ("Key Reinstallation Attack") is a replay attack (a type of exploitable flaw) on the Wi-Fi Protected Access protocol that secures Wi-Fi connections. It was discovered in 2016[1] by the Belgian researchers Mathy Vanhoef and Frank Piessens of the University of Leuven.[2] Vanhoef's research group published details of the attack in October 2017.[3] By repeatedly resetting the nonce transmitted in the third step of the WPA2 handshake, an attacker can gradually match encrypted packets seen before and learn the full keychain used to encrypt the traffic.

The weakness is exhibited in the Wi-Fi standard itself, and not due to errors in the implementation of a sound standard by individual products or implementations. Therefore, any correct implementation of WPA2 is likely to be vulnerable.[4] The vulnerability affects all major software platforms, including Microsoft Windows, macOS, iOS, Android, Linux, OpenBSD and others.[3]

The widely used open-source implementation wpa supplicant, utilized by Linux and Android, was especially susceptible as it can be manipulated to install an all-zeros encryption key, effectively nullifying WPA2 protection in a man-in-the-middle attack.[5][6] Version 2.7 fixed this vulnerability.[7]

The security protocol protecting many Wi-Fi devices can essentially be bypassed, potentially allowing an attacker to intercept[8] sent and received data.

## Contents

* 1 Details
* 2 Patches
* 3 Workarounds
* 4 Continued vulnerability
* 5 See also
* 6 References
* 7 External links

## Details

The attack targets the four-way handshake used to establish a nonce (a kind of "shared secret") in the WPA2 protocol. The standard for WPA2 anticipates occasional Wi-Fi disconnections, and allows reconnection using the same value for the third handshake (for quick reconnection and continuity). Because the standard does not require a different key to be used in this type of reconnection, which could be needed at any time, a replay attack is possible.

An attacker can repeatedly re-send the third handshake of another device's communication to manipulate or reset the WPA2 encryption key.[9] Each reset causes data to be encrypted using the same values, so blocks with the same content can be seen and matched, working backwards to identify parts of the keychain which were used to encrypt that block of data. Repeated resets gradually expose more of the keychain until eventually the whole key is known, and the attacker can read the target's entire traffic on that connection.

According to US-CERT:

> "US-CERT has become aware of several key management vulnerabilities in the 4-way handshake of the Wi-Fi Protected Access II (WPA2) security protocol. The impact of exploiting these vulnerabilities includes decryption, packet replay, TCP connection hijacking, HTTP content injection, and others. Note that as protocol-level issues, most or all correct implementations of the standard will be affected. The CERT/CC and the reporting researcher KU Leuven, will be publicly disclosing these vulnerabilities on 16 October 2017."[10]

The paper describing the vulnerability is available online,[11] and was formally presented at the ACM Conference on Computer and Communications Security on 1 November 2017.[5] US-CERT is tracking this vulnerability, listed as VU#228519, across multiple platforms.[12] The following CVE identifiers relate to the KRACK vulnerability: CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13084, CVE-2017-13086, CVE-2017-13087 and CVE-2017-13088.[5]

Some WPA2 users may counter the attack by updating Wi-Fi client and access point device software, if they have devices for which vendor patches are available.[13] However, vendors may delay in offering a patch, or not provide patches at all in the case of many older devices.[13][1]

## Patches

Patches are available for different devices to protect against KRACK, starting at these versions:

System  | Version  | Patched

|
|

Android | Android 5.0 and later  | Android 2017-11-06 security patch level[14]
ChromeOS | All  | Stable channel 62.0.3202.74[15]
iOS | iOS 11 | iOS 11.1 for iPhone 7, iPad Pro 9.7 inch, and later devices;[16] iOS 11.2 for all other supported devices[17]
LineageOS | 14.1 (Android 7.1) and later
macOS High Sierra | 10.13  | macOS 10.13.1[18]
macOS Sierra | 10.12  | Security Update 2017-001 Sierra[18]
OS X El Capitan | 10.11  | Security Update 2017-004 El Capitan[18]
tvOS | 11  | tvOS 11.1[19]
watchOS | 4  | watchOS 4.1[20]
Windows  | 7 | KB4041681 or KB4041678[21]
Windows  | 8.1 | KB4041693 or KB4041687[21]
Windows  | 10 | KB4042895 (initial version)
KB4041689 (version 1511)
KB4041691 (version 1607)
KB4041676 (version 1703)
Windows 10 version 1709 and later have the patch included in its release[21]
Windows Server  | 2008 | KB4042723[21]
Windows Server  | 2012 | KB4041690 or KB4041679[21]
Windows Server  | 2016 | KB4041691[21]
Ubuntu Linux  | 14.04 LTS, 16.04 LTS, 17.04  | Updates as of October 2017 [22]

## Workarounds

In order to mitigate risk on vulnerable clients, some WPA2-enabled Wi-Fi access points have configuration options that can disable EAPOL-Key[clarification needed] frame re-transmission during key installation. Attackers cannot cause re-transmissions with a delayed frame transmission, thereby denying them access to the network, provided TDLS is not enabled.[23] One disadvantage of this method is that, with poor connectivity, key reinstallation failure may cause failure of the Wi-Fi link.

## Continued vulnerability

In October 2018, reports emerged that the KRACK vulnerability was still exploitable in spite of vendor patches, through a variety of workarounds for the techniques used by vendors to close off the original attack.[24]

## See also

* KrØØk
* IEEE 802.11r-2008 – Problem in 802.11r fast BSS transition (FT)
* Wireless security
* WPA3

## References

1. ↑ 1.0 1.1 "New KRACK Attack Breaks WPA2 WiFi Protocol". 16 October 2017. https://www.bleepingcomputer.com/news/security/new-krack-attack-breaks-wpa2-wifi-protocol/.
2. ↑ "How the KRACK attack destroys nearly all Wi-Fi security". Ars Technica. 2017-10-16. https://arstechnica.com/information-technology/2017/10/how-the-krack-attack-destroys-nearly-all-wi-fi-security.
3. ↑ 3.0 3.1 "'All Wifi Networks' Are Vulnerable to Hacking, Security Expert Discovers". The Guardian. 2017-10-16. ISSN 0261-3077. https://www.theguardian.com/technology/2017/oct/16/wpa2-wifi-security-vulnerable-hacking-us-government-warns.
4. ↑ "Key Reinstallation Attacks". 2017. https://www.krackattacks.com/.
5. ↑ 5.0 5.1 5.2 "Severe flaw in WPA2 protocol leaves Wi-Fi traffic open to eavesdropping". Ars Technica. 2017-10-16. https://arstechnica.com/information-technology/2017/10/severe-flaw-in-wpa2-protocol-leaves-wi-fi-traffic-open-to-eavesdropping/.
6. ↑ "41 percent of Android phones are vulnerable to 'devastating' Wi-Fi attack". The Verge. https://www.theverge.com/2017/10/16/16481252/wi-fi-hack-attack-android-wpa-2-details.
7. ↑ https://w1.fi/cgit/hostap/plain/wpa_supplicant/ChangeLog [bare URL plain text file]
8. ↑ "What the KRACK Wi-Fi vulnerability means for you and your devices". Oct 16, 2017. https://finance.yahoo.com/news/krack-wi-fi-vulnerability-means-201414316.html/.
9. ↑ "Wi-Fi Security Flaw: Billions of devices are affected by Eavesdropping Attacks". LookGadgets. https://lookgadgets.com/news/wi-fi-security-kr00k-eavesdropping-attacks/.
10. ↑ "World WiFi at Risk from KRACK". V3. 2017-10-16. https://www.v3.co.uk/v3-uk/news/3019219/world-wifi-at-risk-from-krack.
11. ↑ "Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2". 2017. https://papers.mathyvanhoef.com/ccs2017.pdf.
12. ↑ "Vendor Information for VU#228519". https://www.kb.cert.org/vuls/byvendor?searchview&Query=FIELD+Reference=228519&SearchOrder=4.
13. ↑ 13.0 13.1 Wagenseil, Paul (16 October 2017). "KRACK Attack Threatens All Wi-Fi Networks: What to Do". https://www.tomsguide.com/us/wifi-krack-attack-what-to-do,news-25990.html.
14. ↑ "Android Security Bulletin – November 2017". https://source.android.com/security/bulletin/2017-11-01.
15. ↑ "Stable Channel Update for Chrome OS". https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html.
16. ↑ "About the security content of iOS 11.1 – Apple Support". https://support.apple.com/en-us/HT208222.
17. ↑ "About the security content of iOS 11.2 – Apple Support". https://support.apple.com/en-us/HT208334.
18. ↑ 18.0 18.1 18.2 "About the security content of macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan – Apple Support". https://support.apple.com/en-us/HT208221.
19. ↑ "About the security content of tvOS 11.1" (in en-US). Apple Support. https://support.apple.com/en-us/HT208219.
20. ↑ "About the security content of watchOS 4.1" (in en-US). Apple Support. https://support.apple.com/en-us/HT208220.
21. ↑ 21.0 21.1 21.2 21.3 21.4 21.5 "CVE-2017-13080 Windows Wireless WPA Group Key Reinstallation Vulnerability". https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-13080.
22. ↑ "Has Ubuntu been patched against the KRACK attack?". https://askubuntu.com/questions/965684/has-ubuntu-been-patched-against-the-krack-attack.
23. ↑ "OpenWrt Project: docs:user-guide:wifi_configuration". https://openwrt.org/docs/user-guide/wifi_configuration.
24. ↑ Chirgwin, Richard (5 October 2018). "Man the harpoons: The KRACK-en reawakens in updated WPA2 attack" (in en). https://www.theregister.co.uk/2018/10/05/krack_updated_wpa2_attack/.

## External links

* krackattacks.com
* Community-maintained vendor response matrix for KRACK

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora
* Australian cyberattacks
* Operation ShadowNet
* Operation Payback

|

2011|

* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* Operation Tunisia
* PlayStation
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism Attack of June 25
* 2013 Yahoo! data breach

2014|

* Anthem medical data breach
* Operation Tovar
* iCloud leaks of celebrity photos
* 2014 JPMorgan Chase data breach
* Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* Hacking Team
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections

2017|

* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster cyberattack
* Petya cyberattack
* 2017 cyberattacks on Ukraine
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Exactis
* Atlanta cyberattack

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* 2019 Bulgarian revenue agency hack
* Capital One data breach
* Zynga Breach

Groups|

| Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* TeaMp0isoN
* UGNazi

|

Advanced Persistent Threat|

* Bureau 121
* Carbanak (group)
* Charming Kitten
* Cozy Bear
* Elfin Team
* Equation Group
* Fancy Bear
* FreeMilk
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Lazarus Group (BlueNorOff) (AndAriel)
* NSO Group
* PLA Unit 61398
* PLA Unit 61486
* PLA Unit 78020
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* Yemen Cyber Army

Individuals|

* DkD[||
* George Hotz
* Guccifer
* Jeremy Hammond
* Junaid Hussain
* Kristoffer von Hassel
* Mustafa Al-Bassam
* MLT
* Ryan Ackroyd
* Sabu
* Topiary
* Track2
* The Jester
* weev

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Speculative Store Bypass (2018)
* Lazy FP State Restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Fallout (2019)
* RIDL (2019)
* ZombieLoad (2019)
* BlueKeep (2019)

Malware|

| 2010|

* Bad Rabbit
* Stuxnet

|

2011|

* Kelihos
* Stars
* Metulji botnet
* Duqu
* Alureon

2012|

* Mahdi
* Carna
* Flame
* FBI
* Shamoon
* Red October
* Dexter

2013|

* DarkSeoul
* CryptoLocker

2014|

* Careto
* DarkHotel
* Duqu 2.0
* Dyreza
* FinFisher
* Brambul
* Destover
* Gameover ZeuS
* Carbanak

2015|

* Dridex
* Rombertik
* TeslaCrypt
* Hidden Tear

2016|

* Hitler
* Petya (NotPetya)
* KeRanger
* Jigsaw
* Pegasus
* Mirai
* X-Agent

2017|

* LogicLocker
* BrickerBot
* WannaCry

2018|

* Kraken

2019|

* ElectricFish
* Grum
* Joanap
* MEMZ
* NetTraveler
* NSA ANT catalog
* R2D2
* Regin
* Tinba
* Titanium
* Vault 7
* X-Tunnel
* ZeroAccess

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/KRACK. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=KRACK&oldid=236579"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template